Architecture / Access Control

IBM i Authority Management Controls

Authority management is the layer everything else depends on. MFA proves who signed on; authority decides what they can actually do once they're in.

Last verified August 19, 2026

The Two Kinds of Authority

IBM i has two distinct authority mechanisms that get confused constantly. Special authorities (*ALLOBJ, *SECADM, *SERVICE, *SAVSYS, *JOBCTL, and others) are system-wide powers granted to a user profile directly. Object authority (*USE, *CHANGE, *ALL, *EXCLUDE) is granted per object or via *PUBLIC, and controls what a specific profile can do to a specific file, program, or library. A profile can have broad object authority without any special authorities, and a profile with *ALLOBJ bypasses object authority checks entirely regardless of what object-level grants say.

Common Special Authorities

Special Authority	What It Grants	Risk If Over-Assigned
*ALLOBJ	Full access to every object on the system, bypassing object authority checks	Effectively unrestricted data access
*SECADM	Ability to administer other users' profiles and authorities	Can create backdoor profiles or elevate others
*SERVICE	Access to service tools and low-level system functions	Can bypass application-layer controls entirely
*SAVSYS	Save and restore any object, including security-sensitive ones	Can exfiltrate or restore over production data
*JOBCTL	Control over job queues, subsystems, and other users' jobs	Can disrupt or intercept other users' processing

*PUBLIC Authority Is the Default Everyone Forgets

Every object has a *PUBLIC authority setting, the access level granted to any profile without a more specific grant. On systems set up years ago under looser conventions, *PUBLIC is often *CHANGE or higher on production libraries, meaning any profile can update or delete data there by default. Tightening *PUBLIC authority is one of the highest-value authority changes available, and also the one most likely to break something if done without testing, because applications and integrations may be quietly depending on that broad default.

Group Profiles and Adopted Authority

Group profiles let you manage authority for a role rather than an individual, which is easier to audit and keeps individual profiles from silently accumulating authority over time as staff change roles. Adopted authority (a program running under its owner's authority rather than the caller's) is the right tool for giving an application the elevated access it needs to do its job, without widening the calling user's own profile. Used well, adopted authority means most users can run with minimal direct authority while still using applications that need broader access internally.

Run an authority collection (STRAUTCOL) before making broad changes. It captures what authority is actually being used during real activity, which is the only reliable way to tighten *PUBLIC or remove unused special authorities without breaking a dependency nobody remembered.

Vendors Covering This Control

Fortra (Powertech)

Fortra's Powertech line (formerly HelpSystems, formerly PowerTech Group) is the longest-running dedicated IBM i security vendor and still the largest install base by most industry surveys, including its own annual State of IBM i Security Study. Powertech Multi-Factor Authentication, Authority Broker, Exit Point Manager, and Compliance Monitor are each strong standalone products.

Strengths

Largest install base among dedicated IBM i security vendors, with the deepest bench of IBM i-specific security expertise
Powertech Authority Broker is a mature, well-regarded privileged access / elevated-authority management product
Exit Point Manager provides granular network access control across FTP, ODBC, DDM, and remote command exit points
Publishes the annual State of IBM i Security Study, a widely cited independent-feeling data source (though vendor-funded)

Limitations

Product line grew through acquisition (PowerTech, Bytware, Robot, Vityl) and integration between modules is less unified than Precisely's single suite
Some legacy product UIs (Robot Console-adjacent tooling) show their age relative to newer competitors
Full stack pricing across MFA, Authority Broker, Exit Point Manager, and Compliance Monitor adds up for smaller shops

Best fit: Shops that specifically need best-in-class privileged access management (Authority Broker) or exit-point network control, and are comfortable managing several point products rather than one suite.

Precisely (Assure Security)

Precisely's Assure Security suite is the broadest single-vendor IBM i security platform on the market, spanning multi-factor authentication, encryption, compliance monitoring, and access control in one licensing family. It is the platform we point mid-size and enterprise IBM i shops to first when they need one vendor covering the most ground.

Strengths

Widest single-suite coverage: MFA, encryption, exit point control, and compliance monitoring under one console
Strong native IBM i journal-based monitoring with real-time SIEM forwarding (Splunk, QRadar, Sentinel)
Assure Encryption supports field-level and full-database encryption without application changes in most cases
Established install base and long IBM i-specific engineering history (originated from Townsend Security and Syncsort lineage)

Limitations

Suite pricing and licensing complexity increases as modules are added; full-suite cost is not the cheapest entry point
MFA client coverage for legacy green-screen sessions requires exit-point configuration that takes real implementation time
Reporting UI is functional but less modern than some newer point-solution dashboards

Best fit: Mid-size to enterprise IBM i shops that want one vendor for MFA, encryption, and compliance monitoring rather than stitching together point products.